---
id: CVE-2026-49919
title: >-
  In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code
  execution due to an integer overflow
summary: >-
  In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code
  execution due to an integer overflow. This could lead to local escalation of
  privilege with no additional execution privileges needed. User interaction is
  not neede…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-190
vendor: google
product: android
affected:
  - android = 14.0
  - android = 15.0
  - android = 16.0
  - android = 17.0
published: '2026-09-08'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T15:47:16.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49919'
references:
  - url: 'https://source.android.com/docs/security/bulletin/2026/2026-09-01'
    label: security@android.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49919.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-49919'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2460423'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-49919'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49919'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00099
epssPercentile: 0.00807
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T03:57:38.047253Z'
ingestedAt: '2026-09-08T19:08:49.641Z'
scores:
  nvd: 7.8
  vendor: 5.8
---

## Overview

In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

## Affected

- `android = 14.0`
- `android = 15.0`
- `android = 16.0`
- `android = 17.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of OpenJDK 11 ELS, Red Hat build of OpenJDK 17, Red Hat build of OpenJDK 21, Red Hat build of OpenJDK 25, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat build of OpenJDK 11 ELS, Red Hat build of OpenJDK 17, Red Hat build of OpenJDK 21, … · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49919.json)